Re: [Security-Discuss] 2007.0 shorewall & ifw problem (bug?)

On Fri, 5 Jan 2007, Antonio wrote:

> I found that shorewall version that comes with mandriva 2007.0 is 3.2.3. 
> According to the shorewall website, current stable release is 3.2.7, and a 
> lot of bug have been fixed since 3.2.3. Now, since shorewall is the choice of 
> mandriva for configure a netfilter firewall, shouldn't bugfixes for shorewall 
> considered security updates? I can find shorewall 3.2.6 on cooker but well, 
> cooker isn't 2007 official.
> 

Bugfix updates are initiated by the package maintainer, for the most 
part.  Posting a bug on the package in bugzilla should trigger the 
activities that would lead to this happening.

The security team generally initiates an update in response to specific
public or privately reported security issues in software, rather than
a general "this software doesn't work" scenario.

Our policy (with a few "special" exceptions) is to backport 
bugfix/patches to the version released with a particular Mandriva 
release. There is a "backports" media now where the maintainer is free 
to put new versions of software, but it is unsupported.

I don't personally use shorewall or ifw, so I can't really comment on 
the issues you're having with them.

-- 
Stew Benedict - Mandriva
____________________________________________________
Want to buy your Pack or Services from Mandriva? 
Go to http://store.mandriva.com
Join the Club : http://www.mandrivaclub.com
____________________________________________________